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DECISION ON APPEAL 
This is a decision on appeal from the Examiner's final 

rejection of claims 1, 4-6, 9-12 , 15-17 and 20-35. Claims 2, 3, 

7, 8, 13, 14, 18 and 19 have been cancelled. 

We reverse. 
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BACKGROUND 

Appellants' invention is directed to a method and system for 

performing local risk-assessment scanning for detecting local 

threats from a remote location. An understanding of the 

invention can be derived from a reading of exemplary independent 

claim 1, which is reproduced as follows: 

1. A method of remotely detecting vulnerabilities on a local 
computer, comprising: 

a) installing an agent on a local computer; 

b) receiving encrypted commands for executing a risk- 
assessment scan from a remote computer utilizing a network; 

c) decrypting the commands on the local computer utilizing 
the agent; 

d) processing the commands on the local computer utilizing 
the agent ; and 

e) performing the risk-assessment scan on the local computer 
in accordance with the processed commands to remotely detect 
local vulnerabilities on the local computer; 

wherein the agent includes a plurality of risk- 
assessment modules ; 

wherein the commands execute the risk-assessment 
modules in a specific manner that is configured at the 
remote computer ; 

wherein the commands each indicate at least one of the 
risk-assessment modules; 

wherein the commands are processed by extracting 
parameters associated with the commands, and executing the 
risk-assessment modules indicated by the commands utilizing 
the associated parameters . 
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The Examiner relies on the following references in rejecting 
the claims: 

Smid et al. (Smid) 4,386,233 May 31\ 1983 

Orchier et al . (Orchier) 6,070,244 May 30, 2000 

Shostack et al. (Shostack) 6,298,445 Oct. 2, 2001 

(filed Apr. 30, 1998) 

Claims 1, 12 and 23-27 stand rejected under the second 
paragraph of 35 U.S. C. § 112 as being indefinite. 

Claims 1, 4-6, 9, 10, 12, 15-17, 20, 21 and 23-35 stand 
rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Shostack and Orchier. 

Claims 11 and 22 stand rejected under 35 U.S.C. § 103(a) as 
being unpatentable over Shostack, Orchier and Smid. 

Rather than reiterate the opposing arguments, reference is 
made to the briefs (filed July 7, 2005 and October 13, 2005) as 
well as the final rejection and answer (mailed March 1, 2005 and 
September 12, 2005) for the respective positions of Appellants 
and the Examiner. Only those arguments actually made by 
Appellants have been considered in this decision. Arguments 
which Appellants could have made but chose not to make in the 
briefs have not been considered (37 CFR § 41.37(c) (1) (vii) ) . 
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OPINION 

With respect to the rejection of the claims under the second 
paragraph of 35 U.S.C. § 112, the Examiner identifies the term 
"configured at the remote computer' 7 as indefinite and states that 
it is unclear as to whether the module or the execution of the 
modules is configured (answer, page 4) . In response, Appellants 
assert that it is the manner of execution of the modules that is 
being configured (brief, page 19) . Appellants further argue that 
although the commands are processed on the local computer, they 
execute the risk-assessment modules by utilizing the agent on the 
local computer (reply brief, page 2) . 

Upon a careful review of the claim language, we find that it 
is clear from the claim language as a whole that it is the manner 
in which the commands execute the risk-assessment modules that is 
configured. "The legal standard for definiteness is whether a 
claim reasonably apprises those of skill in the art of its 
scope." In re Warmerdam , 33 F.3d 1354, 1361, 31 USPQ2d 1754, 
1759 (Fed. Cir. 1994) . We agree with appellants and find that 
the specific element that is configure is sufficiently defined, 
and would reasonably apprise those skilled in the art of the 
scope of these limitations. Accordingly, we will not sustain the 
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rejection of claims 1, 12 and 23-27 under the second paragraph of 
35 U.S.C. § 112. 

Turning now to the 35 U.S.C. § 103 rejection of claims 1, 
4-6, 9, 10, 12, 15-17, 20, 21 and 23-35, we note that the focus 
of Appellants' arguments is that, instead of the claimed 
"commands execute the risk-assessment modules in a specific 
manner that is configured at the remote computer," an authorized 
local user in Shostack configures the modules (brief, page 10) . 
In response, the Examiner further relies on the teachings in 
Shostack related to automatically updating the information about 
the security attacks (col. 2, lines 49-54) and asserts that these 
pushed updates are the same as configuring the modules by the 
remote location (answer, page 6) . Appellants argue that 
Shostack' s distributing database updates is not the same as the 
claimed locally installed agent that receives commands for 
executing the modules from a remote computer (reply brief, page 
4) . Appellants further point out that an icon on the local 
computer enables the user to locally configure the modules in 
Shostack (col. 12, lines 55-57) which is the opposite of the 
claimed requirements ( id . ) . 

We agree with Appellants that automatic updates provided to 
the local computer are not the same as the claimed commands 
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executing the risk-assessment modules in a specific manner that 
is configured at the remote computer. Specifically, configuring 
the modules by the local user in Shostack (col. 12, lines 55-57) 
indicates that any configuration of the modules and the command 
executing them is done locally by the authorized user instead of 
the remote computer. 

We also disagree with the examiner (final rejection, page 6) 
that Orchier provides any teachings related to the parameters 
associated with the commands for processing the commands. In 
particular, as stated by Appellants (reply brief, page 6) , the 
maintenance agent of Orchier takes inputs from the user for 
changes to be made to the database (col. 14, lines 14-17) . We 
also find the Examiner's broad statement (answer, page 7) that 
processing commands by extracting the parameters associated 
therewith are well known to be without evidentiary support and 
mere speculation. The examiner may not, because of doubt that 
the invention is patentable, resort to speculation, unfounded 
assumption or hindsight reconstruction to supply deficiencies in 
the factual basis for the rejection. See In re Warner , 379 F.2d 
1011, 1017, 154 USPQ 173, 178 (CCPA 1967). 
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In view of our analysis above, we find that the Examiner has 
failed to set forth a prima facie case of obviousness with 
respect to claim 1. We further note that the other independent 
claims include features related to configuring how the commands 
execute the modules and processing the command by extracting the 
parameters associated with the commands, which are absent in the 
teachings of the applied prior art. Accordingly, the 35 U.S.C. 
§ 103 rejection of claims 1, 4-6, 9, 10, 12, 15-17, 20, 21 and 
2 3-35 cannot be sustained. 

We note that the Examiner, in rejecting claims 11 and 22, in 
addition to Shostack and Orchier, further relies on Smid which 
neither includes any teachings that read on the disputed claimed 
features nor provides any suggestion for combining the references 
to overcome the deficiencies of Shostack and Orchier as discussed 
above. Accordingly, we do not sustain the 35 U.S.C. § 103 
rejections of claims 11 and 22. 
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CONCLUSION 

In view of the foregoing, the decision of the Examiner 
rejecting claims 1, 12 and 23-27 under 35 U.S. C. § 112 and claims 
1, 4-6, 9-12, 15-17 and 20-35 under 35 U.S.C. § 103 is reversed. 

REVERSED 
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